docs: follow up on the review notes from #77

docs/hmr.md

@@ -60,7 +60,7 @@ Without `SCRIPT_DEBUG`, WordPress does not support Fast Refresh.
 5. `start:blocks` runs `wp-scripts start --hot`, which starts webpack-dev-server, using `webpack.blocks.config.js`.
 6. JS/JSX changes to block components hot-swap in the editor without a full reload; block state is preserved.
 
-`webpack.blocks.config.js` is a thin wrapper over `@wordpress/scripts`' default config. It exists only to strip the `devServer.proxy` option: webpack-dev-server v5 (pinned via the `overrides` block in `package.json`) requires `proxy` to be an array, while wp-scripts still emits the v4 object form, which v5 rejects with `options.proxy should be an array`. The wrapper also sets the dev-server port from `BLOCKS_DEV_SERVER_PORT`.
+`webpack.blocks.config.js` is a thin wrapper over `@wordpress/scripts`' default config, which runs webpack-dev-server 6. It removes the `/build` proxy that wp-scripts adds: block HMR doesn't use it, and its target is hardcoded to `localhost:8887`, so with a custom port it would point at another server. The wrapper also sets the dev-server port from `BLOCKS_DEV_SERVER_PORT` and limits `allowedHosts` to `localhost` and `WP_HOST`.
 
 BrowserSync watches the following:
 

docs/internal/maintenance.md

@@ -101,6 +101,7 @@ The release pull request is opened with `GITHUB_TOKEN`, so GitHub starts no work
 | `@rtcamp/wp-tooling`, lint configs | `package.json` (`^` ranges on the npm registry), `package-lock.json` | Run `npm update @rtcamp/wp-tooling` (and the configs) to move the lock, then re-run init and scaffold validation. |
 | Coding standards | `composer.json` (`rtcamp/wp-phpcs`, `rtcamp/wp-phpstan`) | `composer update rtcamp/wp-phpcs rtcamp/wp-phpstan`; fix or baseline new findings in a separate commit. |
 | Shared CI | `.github/workflows/test-measure.yml` (`@v1`) | `@v1` moves to compatible v1.x releases on its own. For a new major version, move the ref and check the input names against the new `wp-ci.yml`. |
+| `@wordpress/theme` | `package.json` (`4.0.0`, dev dependency) | It is there only as the peer `@wordpress/stylelint-config` needs (`^3.0.0 \|\| ^4.0.0`). `legacy-peer-deps` in `.npmrc` skips peers, so without this entry Stylelint loads the 2.3.0 the editor packages hoist and crashes reading its design tokens. The editor packages keep their own nested copies. Bump it together with `@wordpress/stylelint-config`, inside that package's peer range, and run `npm run lint:css`. |
 | Docs builder | `.github/workflows/documentation.yml` (pinned SHA) | See [Documentation publishing](#documentation-publishing). |
 
 Also keep the plugin header's `Tested up to` in step with the newest WordPress version in the CI matrix.

webpack.blocks.config.js

@@ -1,15 +1,11 @@
 /**
  * Wrapper config for the `start:blocks` invocation.
  *
- * Layered on top of wp-scripts' default config to fix the dev-server issue that
- * bites during `wp-scripts start --hot` for blocks in this stack:
- *
- * webpack-dev-server v5 (resolved at the top level for the CVE-2025-30359 /
- * CVE-2025-30360 fix) is what `webpack serve` loads, but `@wordpress/scripts`
- * still defines `devServer.proxy` in the webpack-dev-server v4 object form, so
- * v5's schema rejects it with "options.proxy should be an array". The bundled
- * `/build` rewrite has no `target`, isn't needed for block HMR, and would fail
- * at runtime even if converted to the v5 array form, so we remove it.
+ * Layered on top of wp-scripts' default config to adjust the webpack-dev-server
+ * 6 setup that `wp-scripts start --hot` runs for blocks. The stock config adds
+ * a `/build` proxy whose target is hardcoded to `localhost:8887`. Block HMR
+ * doesn't use it, and once the port comes from `BLOCKS_DEV_SERVER_PORT` it
+ * would point at whatever else listens on 8887, so we remove it.
  *
  * All dev-server knobs are read from `.env.local` so they can change without
  * editing this file.
@@ -54,7 +50,7 @@ const devServerPort = toPort(
  * Apply the dev-server fixes to a single webpack config.
  *
  * @param {Object} singleConfig A webpack configuration object.
- * @return {Object} The same config, dev-server v5 compatible.
+ * @return {Object} The same config, with the dev-server changes applied.
  */
 const fixDevServer = ( singleConfig ) => {
 	// Only the script config carries a devServer; the module config sets it to
@@ -63,8 +59,8 @@ const fixDevServer = ( singleConfig ) => {
 		return singleConfig;
 	}
 
-	// webpack-dev-server v5 requires `proxy` to be an array; wp-scripts ships a
-	// v4-style object. Not needed for block HMR, so drop it.
+	// wp-scripts adds a `/build` proxy hardcoded to localhost:8887. Block HMR
+	// doesn't need it, and with a custom port it would hit another server.
 	delete singleConfig.devServer.proxy;
 
 	// Multiple sites can run the dev server at once, so the port is read from